Phishing is an attempt to persuade someone to hand over information, open a file, or visit a page controlled by an attacker. The message may arrive by email, SMS, messaging app, or social network. The format changes; the pressure to act quickly usually remains.
This article organizes the signs that help you assess a message and what to do when you become suspicious — including after you have already clicked.
Look at the context before the content
A message should make sense to you. Three questions resolve most cases:
- Was I expecting this contact?
- Does the request match this company’s or service’s normal process?
- Why does the message want me to decide right now?
The third is the most revealing. Phishing works by creating an emotion that overrides verification: urgency (“your account will be blocked in 24 hours”), fear (“we detected unauthorized access”), authority (“a message from management”), or opportunity (“you have been selected”).
These signs alone do not prove fraud — legitimate companies also send urgent notices. They indicate that it is worth stopping and checking through another channel. Rushing you is the attacker’s goal, not a feature of the subject itself.
Be especially wary of requests to ignore normal procedures: pay through a different channel, approve something outside the system, keep it from colleagues. Scams that demand secrecy are asking to escape verification.
Check the destination, not the appearance
A link’s visible text can differ from its actual address. Before opening it, check the full domain and identify the registrable domain: the public suffix plus the name immediately to its left. The number of dots varies: in banco.com.br, the suffix is .com.br and the registrable domain is banco.com.br; in seguro-login.net, the suffix is .net and the registrable domain is seguro-login.net. MDN’s definition explains this distinction. The examples below compare destinations:
| What you see | Actual domain | Genuine? |
|---|---|---|
banco.com.br | banco.com.br | Yes |
banco.com.br.seguro-login.net | seguro-login.net | No |
banco-com-br.info | banco-com-br.info | No |
bancoo.com.br | bancoo.com.br | No |
The most common trick is in the middle of the table: the legitimate name appears in full, but as a subdomain of another site. Everything before the actual domain can be freely chosen by whoever registered the address.
On mobile devices, this check is harder because the browser shortens the address. When in doubt, access the service by typing its known address or through the official app — never through the link you received.
The sender’s displayed name can also be forged. Photos, names, and logos are not proof of authenticity: they are the easiest elements to copy.
The signs have changed — and writing quality is no longer one of them
For a long time, people were taught to look for grammatical errors. That advice has aged: automatically generated text has eliminated the mistakes that used to reveal scams, and well-written, personalized, context-aware messages are now common.
What has not changed is the structure of the request. Every phishing attempt needs you to do something: provide a credential, approve an authentication request, open an attachment, make a payment, or install something.
That is why you should verify the action, not the appearance. A flawless message asking for your verification code is still a scam. A poorly written message from your manager may be legitimate.
What to do when you suspect phishing
- Do not provide passwords, verification codes, or financial details through the message.
- Contact the organization through a channel you already know — the number on your card, the official app, a website address you type yourself.
- Use the internal reporting process if you are at a company.
- If you already clicked or provided data: change the password through the official website, end active sessions, check the registered MFA methods, and notify the responsible team.
Step 4 deserves emphasis. Falling for a scam is no reason to hide it — it is a reason to act quickly. The difference between a contained incident and a serious one is often how long it took someone to speak up. Teams that treat reports as personal failings end up learning about incidents much later.
Multifactor authentication reduces the damage from an exposed password, but is also a target for social engineering: never approve a login request you did not initiate, and never pass on a code you received — no legitimate service asks for this over the phone or in a message.
For defense teams
Training works best alongside simple reporting and response processes. If reporting takes effort, people do not report.
Measure the right things. Click rates in simulations are a weak metric — they measure the difficulty of the exercise more than the organization’s maturity, and using them as punishment teaches people to hide mistakes. More useful metrics include:
- time to the first report of a real campaign;
- proportion of people who reported, beyond those who clicked;
- time between the report and containment — blocking the sender, removing messages from inboxes;
- how many reports came from people who did not fall for it — a sign of a healthy culture.
A campaign noticed within minutes by one attentive person is worth more than a low click rate on an easy test.
On the technical side, CISA recommends combining controls that do not depend on people’s attention: email domain authentication (SPF, DKIM, and DMARC), attachment and link filtering, and phishing-resistant MFA for the most sensitive accounts. Training is the last layer, not the first.
The one-minute pause
When a message demands urgency, take a short pause: stop clicking, read the full request, check the domain, and confirm the request through an independent channel. The message may be legitimate — but this procedure prevents the pressure it creates from determining your decision.
When reporting a suspicion, preserve context without forwarding links or attachments to colleagues. Provide the internal channel with the sender, time, and reason the message seemed unusual. Forwarding the original to the security team through the defined channel is useful; sharing it in the team group only broadens exposure.
Next step
Find these now, before you need them: your company’s phishing reporting channel and your bank’s official phone number — the one on the back of your card, not in a message. Having those two details at hand turns a decision under pressure into a thirty-second check.
